CVE-2026-120859 · Package
NO FIX YET · SEE WHAT TO DO
PyMoDAQ and its pymodaq_data, pymodaq_gui and pymodaq_utils packages unpickle or eval data taken from HDF5 attributes, HDF5 string nodes, .dock layout files and XML settings files. A user who opens a crafted file lets an attacker run arbitrary Python code on their machine.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any installation of PyMoDAQ or the pymodaq_data, pymodaq_gui or pymodaq_utils packages in the affected ranges is exposed when a user opens an attacker-supplied HDF5, .dock or XML file. Teams that only work with their own trusted data files and never open files from others are at lower risk, but the sources do not say whether the flaw is reachable without opening a file.
Not affected if trusted-files-only, versions-patched
Who cares hdf5, pymodaq, python, scientific-instrumentation
pip show pymodaq and the pymodaq_data, pymodaq_gui and pymodaq_utils versions with pip show pymodaq_data pymodaq_gui pymodaq_utils.4.4.13 or later.5.1.15 or later on the 5.1 line, 5.2.14 or later on the 5.2 line, and or later on the 5.3 line.PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
5.3.10This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.